<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: cartridges]]></title>
    <link>http://securityratty.com/tag/cartridges</link>
    <description></description>
    <pubDate>Tue, 05 Feb 2008 21:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[A New Way to Back Up Digital Files on paper]]></title>
      <link>http://securityratty.com/article/f29b43ae964909cbeacf815e65f8018e</link>
      <guid>http://securityratty.com/article/f29b43ae964909cbeacf815e65f8018e</guid>
      <description><![CDATA[This is pretty funny a free open source application where you can backup your data by printing it, on paper, in a bar code format. A friend of mine says he tried it and that it even works
PaperBack is...]]></description>
      <content:encoded><![CDATA[<p>This is pretty funny &#8212; a free open source application where you can backup your data by printing it, on paper, in a bar code format. A friend of mine says he tried it and that it even works &#8211;</p>
<blockquote><p>PaperBack is a free application that allows you to back up your precious files on the ordinary paper in the form of the oversized bitmaps. If you have a good laser printer with the 600 dpi resolution, you can save up to 500,000 bytes of uncompressed data on the single A4/Letter sheet. Integrated packer allows for much better data density - up to 3,000,000+ (three megabytes) of C code per page.</p>
<p>You may ask - why? Why, for heaven&#8217;s sake, do I need to make paper backups, if there are so many alternative possibilities like CD-R&#8217;s, DVD±R&#8217;s, memory sticks, flash cards, hard disks, streamer tapes, ZIP drives, network storages, magnetooptical cartridges, and even 8-inch double-sided floppy disks formatted for DEC PDP-11? (I still have some). The answer is simple: you don&#8217;t. However, by looking on CD or magnetic tape, you are not able to tell whether your data is readable or not. You must insert your medium into the drive (if you have one!) and try to read it.</p>
<p>Paper is different. Do you remember the punched cards? EBCDIC and all this stuff. For years, cards were the main storage medium for the source code. I agree that 100K+ programs were&#8230; unhandly, but hey, only real programmers dared to write applications of this size. And used cards were good as notepads, too. Punched tapes were also common. And even the most weird codings, like CDC or EBCDIC, were readable by humans (I mean, by real programmers).</p></blockquote>
<p>Read the <a rel="nofollow" target="_blank" href="http://www.ollydbg.de/Paperbak/index.html">whole thing here.<br />
</a></p>]]></content:encoded>
      <pubDate>Thu, 04 Sep 2008 04:28:19 +0000</pubDate>
      <category domain="http://securityratty.com/tag/paper">paper</category>
      <category domain="http://securityratty.com/tag/code">code</category>
      <category domain="http://securityratty.com/tag/source code">source code</category>
      <category domain="http://securityratty.com/tag/paper backups">paper backups</category>
      <category domain="http://securityratty.com/tag/real programmers dared">real programmers dared</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/data density">data density</category>
      <category domain="http://securityratty.com/tag/real programmers">real programmers</category>
      <category domain="http://securityratty.com/tag/flash cards">flash cards</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/383345885/">A New Way to Back Up Digital Files on paper</source>
    </item>
    <item>
      <title><![CDATA[Lock-In]]></title>
      <link>http://securityratty.com/article/1ab18251eb3274fedf88e690c694ab78</link>
      <guid>http://securityratty.com/article/1ab18251eb3274fedf88e690c694ab78</guid>
      <description><![CDATA[Buying an iPhone isn't the same as buying a car or a toaster. Your iPhone comes with a complicated list of rules about what you can and can't do with it. You can't install unapproved third-party...]]></description>
      <content:encoded><![CDATA[<p>Buying an iPhone isn't the same as buying a car or a toaster. Your iPhone comes with a complicated list of rules about what you can and can't do with it. You can't install unapproved third-party applications on it. You can't unlock it and use it with the cellphone carrier of your choice. And Apple is serious about these rules: A software update released in September 2007 erased unauthorized software and -- in some cases -- rendered unlocked phones unusable.</p>

<p>"<a href="http://www.nytimes.com/2007/09/29/technology/29iphone.html">Bricked</a>" is the term, and Apple isn't the least bit apologetic about it.</p>

<p>Computer companies want more control over the products they sell you, and they're resorting to increasingly draconian security measures to get that control. The reasons are economic.</p>

<p>Control allows a company to limit competition for ancillary products. With Mac computers, anyone can sell software that does anything. But Apple gets to decide who can sell what on the iPhone. It can foster competition when it wants, and reserve itself a monopoly position when it wants. And it can dictate terms to any company that wants to sell iPhone software and accessories.</p>

<p>This increases Apple's bottom line. But the primary benefit of all this control for Apple is that it increases lock-in. "Lock-in" is an economic term for the difficulty of switching to a competing product. For some products -- cola, for example -- there's no lock-in. I can drink a Coke today and a Pepsi tomorrow: no big deal. But for other products, it's harder.</p>

<p>Switching word processors, for example, requires installing a new application, learning a new interface and a new set of commands, converting all the files (which may not convert cleanly) and custom software (which will certainly require rewriting), and possibly even buying new hardware. If Coke stops satisfying me for even a moment, I'll switch: something Coke learned the hard way in 1985 when it changed the formula and started marketing New Coke. But my word processor has to really piss me off for a good long time before I'll even consider going through all that work and expense.</p>

<p>Lock-in isn't new. It's why all gaming-console manufacturers make sure that their game cartridges don't work on any other console, and how they can price the consoles at a loss and make the profit up by selling games. It's why Microsoft never wants to open up its file formats so other applications can read them. It's why music purchased from Apple for your iPod won't work on other brands of music players. It's why every U.S. cellphone company fought against phone number portability. It's why Facebook sues any company that tries to scrape its data and put it on a competing website. It explains airline frequent flyer programs, supermarket affinity cards and the new My Coke Rewards program.</p>

<p>With enough lock-in, a company can protect its market share even as it reduces customer service, raises prices, refuses to innovate and otherwise abuses its customer base. It should be no surprise that this sounds like pretty much every experience you've had with IT companies: Once the industry discovered lock-in, everyone started figuring out how to get as much of it as they can.</p>

<p>Economists <a href="http://www.amazon.com/Information-Rules-Strategic-Network-Economy/dp/087584863X/ref=sr_1_1?ie=UTF8&s=books&qid=1202236504&sr=1-1">Carl Shapiro and Hal Varian</a> even proved that the value of a software company is the total lock-in. Here's the logic: Assume, for example, that you have 100 people in a company using MS Office at a cost of $500 each. If it cost the company less than $50,000 to switch to Open Office, they would. If it cost the company more than $50,000, Microsoft would increase its prices.</p>

<p>Mostly, companies increase their lock-in through security mechanisms. Sometimes patents preserve lock-in, but more often it's copy protection, digital rights management (DRM), code signing or other security mechanisms. These security features aren't what we normally think of as security: They don't protect us from some outside threat, they protect the companies from <em>us</em>.</p>

<p>Microsoft has been planning this sort of control-based security mechanism for years. First called <a href="http://schneier.com/crypto-gram-0208.html#1">Palladium</a> and now NGSCB (Next-Generation Secure Computing Base), the idea is to build a control-based security system into the computing hardware. The details are complicated, but the results range from only allowing a computer to boot from an authorized copy of the OS to prohibiting the user from accessing "unauthorized" files or running unauthorized software. The competitive benefits to Microsoft are <a href="http://www.cl.cam.ac.uk/~rja14/Papers/tcpa.pdf">enormous</a> (.pdf).</p>

<p>Of course, that's not how <a href="http://www.microsoft.com/technet/archive/security/news/ngscb.mspx">Microsoft advertises NGSCB</a>. The company has positioned it as a security measure, protecting users from worms, Trojans and other malware. But control does not equal security; and this sort of control-based security is <a href="http://www.schneier.com/blog/archives/2005/08/trusted_computi.html">very difficult to get right</a>, and sometimes makes us more vulnerable to other threats. Perhaps this is why Microsoft is quietly killing NGSCB -- we've gotten BitLocker, and we might get some other security features down the line -- despite the huge investment hardware manufacturers made when incorporating special security hardware into their motherboards.</p>

<p>In my <a href="http://www.wired.com/politics/security/commentary/securitymatters/2008/01/securitymatters_0124">last column</a>, I talked about the security-versus-privacy debate, and how it's actually a debate about liberty versus control. Here we see the same dynamic, but in a commercial setting. By confusing control and security, companies are able to force control measures that work against our interests by convincing us they are doing it for our own safety.</p>

<p>As for Apple and the iPhone, I don't know what they're going to do. On the one hand, there's this <a href="http://www.bloomberg.com/apps/news?pid=20601087&sid=aWmgi08ZjbpM">analyst report that claims there are over a million unlocked iPhones</a>, costing Apple between $300 million and $400 million in revenue. On the other hand, Apple is <a href="http://www.engadget.com/2007/10/17/apple-planning-iphone-sdk-for-february/ ">planning to release</a> a software development kit this month, reversing its earlier restriction and allowing third-party vendors to write iPhone applications. Apple will attempt to keep control through a secret application key that will be required by all "official" third-party applications, but of course it's already been <a href="http://www.engadget.com/2008/01/28/iphone-sdk-key-leaked/">leaked</a>.</p>

<p>And the security arms race goes on ...</p>

<p><br />
This essay <a href="http://www.wired.com/politics/security/commentary/securitymatters/2008/02/securitymatters_0207">previously appeared</a> on Wired.com.</p>

<p>EDITED TO ADD (2/12): SlashDot <a href="http://yro.slashdot.org/yro/08/02/07/2138201.shtml">thread</a>.</p>

<p>And critical <a href="http://stumble.kapowaz.net/post/25792347">commentary</a>, which is oddly political:</p>

<blockquote>This isn’t lock-in, it’s called choosing a product that meets your needs. If you don’t want to be tied to a particular phone network, don’t buy an iPhone. If installing third-party applications (between now and the end of February, when officially-sanctioned ones will start to appear) is critically important to you, don’t buy an iPhone.

<p>It’s one thing to grumble about an otherwise tempting device not supporting some feature you would find useful; it’s another entirely to imply that this represents anti-libertarian lock-in. The fact remains, you are free to buy one of the many other devices on the market that existed before there ever was an iPhone.</blockquote></p>

<p>Actually, lock-in is one of the factors you have to consider when choosing a product to meet your needs.  It's not one thing or the other.  And lock-in is certainly not "anti-libertarian."  Lock-in is what you get when you have an unfettered free market competing for customers; it's libertarian utopia.  Government regulations that limit lock-in tactics -- something I think would be very good for society -- is what's anti-libertarian.</p>

<p>Here's <a href="http://www.kryogenix.org/days/2008/02/08/there-can-be-no-fud">a commentary</a> on that previous commentary.  <a href="http://girtby.net/archives/2008/2/8/vendor-lock-in">This</a> is some good commentary, too.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=Ykew7fE"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=Ykew7fE" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=LfLokuE"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=LfLokuE" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Tue, 12 Feb 2008 03:08:15 +0000</pubDate>
      <category domain="http://securityratty.com/tag/lock-in">lock-in</category>
      <category domain="http://securityratty.com/tag/software">software</category>
      <category domain="http://securityratty.com/tag/software development kit">software development kit</category>
      <category domain="http://securityratty.com/tag/custom software">custom software</category>
      <category domain="http://securityratty.com/tag/software company">software company</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/hardware">hardware</category>
      <category domain="http://securityratty.com/tag/special security hardware">special security hardware</category>
      <category domain="http://securityratty.com/tag/security mechanism">security mechanism</category>
      <source url="http://www.schneier.com/blog/archives/2008/02/lockin.html">Lock-In</source>
    </item>
    <item>
      <title><![CDATA[Toner scheme busted by sharp eyed Xerox employees]]></title>
      <link>http://securityratty.com/article/ac008bd15e17e0aa5042e2371c2b3273</link>
      <guid>http://securityratty.com/article/ac008bd15e17e0aa5042e2371c2b3273</guid>
      <description><![CDATA[A former Xerox customer service agent on Tuesday pleaded guilty to mail fraud for stealing and selling cartridges stolen from his former employer...]]></description>
      <content:encoded><![CDATA[A former Xerox customer service agent on Tuesday pleaded guilty to mail fraud for stealing and selling cartridges stolen from his former employer online.]]></content:encoded>
      <pubDate>Tue, 05 Feb 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/employer online">employer online</category>
      <category domain="http://securityratty.com/tag/mail fraud">mail fraud</category>
      <category domain="http://securityratty.com/tag/guilty">guilty</category>
      <category domain="http://securityratty.com/tag/cartridges">cartridges</category>
      <category domain="http://securityratty.com/tag/tuesday">tuesday</category>
      <source url="http://www.networkworld.com/news/2008/020608-toner-scheme-busted-by-sharp.html?fsrc=rss-security">Toner scheme busted by sharp eyed Xerox employees</source>
    </item>
  </channel>
</rss>
